- Freeradius-Users - lists.freeradius.org

Use 2 modules to auth together.
by luckydog xf 28 Nov '18

28 Nov '18

Probably I'm wrong, MSCHAP won't work no matter what kind of password encyption used if LDAP is as backend. MSCHAP is using ntlm_auth and winbind which is MS related, or its equivalent, Samba. On Wed, Nov 28, 2018 at 8:56 AM luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: > One more thing to add. > 1. MS AD as backend, you could choose MSchap variant, like EAP-mschapv2, > I'm NOT sure. > 2. LDAP as backend, you could use MSCHAP too, as long as you add samba > schema and add sambaSamAccount objectclass( maybe this one) in your LDAP > entry, then your user's password could stored as NThash encrypted（This is > how MS AD user's password is encrypted）. The default is SSHA512. On Wed, Nov 28, 2018 at 8:56 AM luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >* Let me complete this topic. Feel free to correct me if I'm wrong. LOL *>>* In short, *>>* 1. MS AD != OTP and MS AD != PAP. *>>* 2. MS AD = MSCHAP( and MSCHAP v2, not sure CHAP) *>>* 3. LDAP = PAP = OTP *>>* Long explaination: *>>* 1. It won't be User-Password as MS-CHAP2-Response Attribute in Access-Request packet has the password you input encoded and encrypted. In other words, MSCHAP does have password but in another form which FreeRadius cannot and won't check it either, and it's exepcted. *>>* That's the way how MSCHAP works, *>>* see https://tools.ietf.org/html/rfc2548 <https://tools.ietf.org/html/rfc2548> (page 14-15） *>>* NO user-password, no OTP, b/c there is no way to know your orginal OTP, it is in MS-CHAP2-Responsed. *>>* 2. user-password in AD schema is write-only, you cannot use Freeradius LDAP module to revitive it, and any other LDAPclient, like LDAPadmins. So this means NO known good password, which also means NO PAP. *>>* 3. MS AD is mschap only, as far as I know. Guess it's challeng and response change everytine, so it's security, just a guess. *>>* 4. LDAP means PAP and OTP, as User-Password is available. *>>* That's all. *>>* >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> *>>>* Hi, here is my access-request from radiusd -fX *>>* Only an extra State is added comparing to the 1st auth. *>>* # Access-Challenge *>* Ready to process requests *>* (6) Received Access-Request Id 13 from 172.30.240.130:7460 <http://172.30.240.130:7460> to172.16.237.52:1812 length 205 *>* (6) NAS-Identifier = "Artisan_FW" *>* (6) State = 0x654e6c7472756d474c576c6a61584b37 *>* (6) User-Name = "someone" *>* (6) MS-CHAP2-Response = *>* 0x0f003132333435363638393035398846f8ca00000000000000000ac4b98d3afb9b42a0e1a1def464b78e5f6b13033d6a6e7c *>* (6) MS-CHAP-Challenge = 0x680d6e49baa9e6f4b4f622042f0917f6 *>* (6) NAS-IP-Address = 172.30.240.130 *>* (6) NAS-Port-Type = Virtual *>* (6) Called-Station-Id = "172.30.240.130" *>* (6) Acct-Session-Id = "033ac507" *>* (6) Connect-Info = "admin-login" *>* (6) Fortinet-Vdom-Name = "root" *>* (6) session-state: No cached attributes *>* (6) # Executing section authorize from file /etc/raddb/sites-enabled/default *>>* As you can see there is NO User-Password attribute, which is OTP. It *>* seems that it's caused by mschap authentication, there is no such *>* attribute in mschap. *>>* Is there any way to input User-Password( in other words, OTP)? or my *>* own auth method would fail to auth as there is no OTP. *>>>* Thanks. *>>* On Nov 26, 2018, at 8:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> *>* <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> *>* wrote: *>>* Find a challenge-support Device and test it out. Let me answer it. *>>* 1. Not every NAS supports Access-Challenge, they may just ignore it *>* and treat it as access-reject. According to my test. *>>* 2. my way of raise challeng is correct, it's built-in way of FreeRADIUS. *>>* 3. else part seesm correct, too, though I haven't hanle my own auth *>* method, it's just a fake one. *>>* Thank Alan again. *>>>* On Nov 26, 2018, at 12:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> *>* <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> *>* wrote: *>>>* Thank, Alan, you enlighten me. *>>* Turns out NAS( my VPN) does not support Access-Challenge. Googled and *>* found that Challenge seems to be a speical access-request packet with the *>* Code field set to 11. So can I make the conclusion that it would send an *>* access-quest again? in other words, start a new authentication process *>* like another normal request with an exception that State attribute exists. *>>* Let me suppose my VPN supports Access-Challenge, so my configuation is *>* something like: *>* ------------------------------- *>>* authorize { *>* # The first auth does not have any State attribute. *>* if (!State) { *>* # MS-CHAP has no User-Password, so it's true. *>* if (!User-Password ) { *>* # If !State and User-Password is null, then *>* goes to MS-CHAP: *>* update { *>* &control:Auth-Type := MS-CHAP *>* } *>* } *>>* else { reject } *>>* # Make sure it does not contain any other attributes except State. *>>>* else { *>>* update { *>>* # IS THIS PART CORRECT ? I think so, as a new request is *>* issued by challage, so it would start over from top to buttom to walk *>* throught the entire process. *>>* &control:Auth-Type := MY_OWN_OTP_AUTH *>>* } *>* } *>>* } *>>* authentication { *>>* Auth-Type MS-CHAP { *>* mschap *>* if (ok) { *>* update reply { *>* # Create a random State attribute: *>* State := "%{randstr:XXXXXXXXXXXXX}" *>* Reply-Message := "Please type your OTP:" *>* } *>* # Return Access-Challenge, goes to the 2nd auth. *>>* # IS IT the correct way to raise a challange? *>* challenge *>>* } *>>* Please help me to take a look at configuration above, two questions: *>>* 1. Is else part correct? which will use my own python auth module *>* 2. Is it correct to raise a challenge using 'challenge' filter of *>* FreeRADIUS? *>>* Thanks again. *>>>* On Mon, Nov 26, 2018 at 8:10 PM Alan DeKok <aland atdeployingradius.com <http://atdeployingradius.com> *>* <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> *>* wrote: *>>* >*** On Nov 26, 2018, at 2:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> <http://gmail.com <http://gmail.com/>> <http://gmail.com <http://gmail.com/> <http://gmail.com/ <http://gmail.com/>>> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>>>> wrote: *>* ***>* > Our user is in AD and VPN will do an MSCHAP authentication first and *>* *>* > filter property of User-Name from access request, then call an *>* *>* > access-challenge to verify against the other module whose logic is as *>* *>* > simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=> <http://xxx/check/username= <http://xxx/check/username=>> *>* <http://xxx/check/username= <http://xxx/check/username=>> *>* <http://xxx/check/username= <http://xxx/check/username=>> *>* *>* > <http://xxx/check/username= <http://xxx/check/username=> *>* <http://xxx/check/username= <http://xxx/check/username=>>><USER-NAME>&OTP=<xxxxxx>, if return 200, *>* *>* it's *>* *>* > ok. *>* *>>* That's really just more authorization. *>* *>>* > Basically, I want to auth a single login against two modules, only both *>* *>* > of them are successful, the auth could be deemed as OK. *>* *>>* That's possible, subject to certain caveats. *>* *>>* > # ### authentication ##### *>* *>* > authentication { *>* *>* > Auth-Type MS-CHAP { *>* *>* > mschap *>* *>* > if (ok) { *>* *>* > update reply { *>* *>* > # Create a random State attribute: *>* *>* > State := "%{randstr:XXXXXXXXXXXXX}" *>* *>* > Reply-Message := "Please type your OTP:" *>* *>* > } *>* *>* > # Return Access-Challenge, goes to the 2nd auth. *>* *>* > challenge *>* *>>* That's good, but it likely won't work due to the NAS. Doing OTP like *>* *>* that requires support from the NAS. Does the NAS support doing MS-CHAP and *>* *>* then receiving an Access-Challenge? *>* *>>* If it does, then your next step is to write down what you want to *>* *>* happen, like this: *>* *>>* 1) packet 1 contains MS-CHAP *>* *>* 2) it authenticates agains MS-CHAP *>* *>* 3) if MS-CHAP is successful, it returns a State, challenge, and reply *>* *>* message *>* *>* 4) when the next packet comes in with a state attribute, authenticate the *>* *>* OTP *>* *>>* Note that the packet in step 4 *should not* contain any MS-CHAP *>* *>* attributes. It should just contain the response to the OTP. *>* *>>* So your freeradius configuration is: *>* *>>* 1) run MS-CHAP like normal *>* *>* 2) do state / reply-message / challenge in "Auth-Type MS-CHAP" *>* *>>* As a *separate* item: *>* *>>* 3) if packet contains State *>* *>* 4) do OTP verification *>* *>>* The only thing tying the two packets together is the State attribute. *>* *>* They are otherwise completely independent. *>* *>>* Alan DeKok. *>* *>>>>* - *>* *>* List info/subscribe/unsubscribe? See *>* *>* http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html> *>* <http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>>* *>>

1 0

Use 2 modules to auth together.
by luckydog xf 28 Nov '18

28 Nov '18

Let me complete this topic. Feel free to correct me if I'm wrong. LOL In short, 1. MS AD != OTP and MS AD != PAP. 2. MS AD = MSCHAP( and MSCHAP v2, not sure CHAP) 3. LDAP = PAP = OTP Long explaination: 1. It won't be User-Password as MS-CHAP2-Response Attribute in Access-Request packet has the password you input encoded and encrypted. In other words, MSCHAP does have password but in another form which FreeRadius cannot and won't check it either, and it's exepcted. That's the way how MSCHAP works, see https://tools.ietf.org/html/rfc2548 (page 14-15） NO user-password, no OTP, b/c there is no way to know your orginal OTP, it is in MS-CHAP2-Responsed. 2. user-password in AD schema is write-only, you cannot use Freeradius LDAP module to revitive it, and any other LDAPclient, like LDAPadmins. So this means NO known good password, which also means NO PAP. 3. MS AD is mschap only, as far as I know. Guess it's challeng and response change everytine, so it's security, just a guess. 4. LDAP means PAP and OTP, as User-Password is available. That's all. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Hi, here is my access-request from radiusd -fX Only an extra State is added comparing to the 1st auth. # Access-Challenge Ready to process requests (6) Received Access-Request Id 13 from 172.30.240.130:7460 to172.16.237.52:1812 length 205 (6) NAS-Identifier = "Artisan_FW" (6) State = 0x654e6c7472756d474c576c6a61584b37 (6) User-Name = "someone" (6) MS-CHAP2-Response = 0x0f003132333435363638393035398846f8ca00000000000000000ac4b98d3afb9b42a0e1a1def464b78e5f6b13033d6a6e7c (6) MS-CHAP-Challenge = 0x680d6e49baa9e6f4b4f622042f0917f6 (6) NAS-IP-Address = 172.30.240.130 (6) NAS-Port-Type = Virtual (6) Called-Station-Id = "172.30.240.130" (6) Acct-Session-Id = "033ac507" (6) Connect-Info = "admin-login" (6) Fortinet-Vdom-Name = "root" (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/default As you can see there is NO User-Password attribute, which is OTP. It seems that it's caused by mschap authentication, there is no such attribute in mschap. Is there any way to input User-Password( in other words, OTP)? or my own auth method would fail to auth as there is no OTP. Thanks. On Nov 26, 2018, at 8:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Find a challenge-support Device and test it out. Let me answer it. 1. Not every NAS supports Access-Challenge, they may just ignore it and treat it as access-reject. According to my test. 2. my way of raise challeng is correct, it's built-in way of FreeRADIUS. 3. else part seesm correct, too, though I haven't hanle my own auth method, it's just a fake one. Thank Alan again. On Nov 26, 2018, at 12:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Thank, Alan, you enlighten me. Turns out NAS( my VPN) does not support Access-Challenge. Googled and found that Challenge seems to be a speical access-request packet with the Code field set to 11. So can I make the conclusion that it would send an access-quest again? in other words, start a new authentication process like another normal request with an exception that State attribute exists. Let me suppose my VPN supports Access-Challenge, so my configuation is something like: ------------------------------- authorize { # The first auth does not have any State attribute. if (!State) { # MS-CHAP has no User-Password, so it's true. if (!User-Password ) { # If !State and User-Password is null, then goes to MS-CHAP: update { &control:Auth-Type := MS-CHAP } } else { reject } # Make sure it does not contain any other attributes except State. else { update { # IS THIS PART CORRECT ? I think so, as a new request is issued by challage, so it would start over from top to buttom to walk throught the entire process. &control:Auth-Type := MY_OWN_OTP_AUTH } } } authentication { Auth-Type MS-CHAP { mschap if (ok) { update reply { # Create a random State attribute: State := "%{randstr:XXXXXXXXXXXXX}" Reply-Message := "Please type your OTP:" } # Return Access-Challenge, goes to the 2nd auth. # IS IT the correct way to raise a challange? challenge } Please help me to take a look at configuration above, two questions: 1. Is else part correct? which will use my own python auth module 2. Is it correct to raise a challenge using 'challenge' filter of FreeRADIUS? Thanks again. On Mon, Nov 26, 2018 at 8:10 PM Alan DeKok <aland atdeployingradius.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >*** On Nov 26, 2018, at 2:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> <http://gmail.com <http://gmail.com/>> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>>> wrote: ***>* > Our user is in AD and VPN will do an MSCHAP authentication first and *>* > filter property of User-Name from access request, then call an *>* > access-challenge to verify against the other module whose logic is as *>* > simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=> <http://xxx/check/username=> <http://xxx/check/username=> *>* > <http://xxx/check/username= <http://xxx/check/username=>><USER-NAME>&OTP=<xxxxxx>, if return 200, *>* it's *>* > ok. *>>* That's really just more authorization. *>>* > Basically, I want to auth a single login against two modules, only both *>* > of them are successful, the auth could be deemed as OK. *>>* That's possible, subject to certain caveats. *>>* > # ### authentication ##### *>* > authentication { *>* > Auth-Type MS-CHAP { *>* > mschap *>* > if (ok) { *>* > update reply { *>* > # Create a random State attribute: *>* > State := "%{randstr:XXXXXXXXXXXXX}" *>* > Reply-Message := "Please type your OTP:" *>* > } *>* > # Return Access-Challenge, goes to the 2nd auth. *>* > challenge *>>* That's good, but it likely won't work due to the NAS. Doing OTP like *>* that requires support from the NAS. Does the NAS support doing MS-CHAP and *>* then receiving an Access-Challenge? *>>* If it does, then your next step is to write down what you want to *>* happen, like this: *>>* 1) packet 1 contains MS-CHAP *>* 2) it authenticates agains MS-CHAP *>* 3) if MS-CHAP is successful, it returns a State, challenge, and reply *>* message *>* 4) when the next packet comes in with a state attribute, authenticate the *>* OTP *>>* Note that the packet in step 4 *should not* contain any MS-CHAP *>* attributes. It should just contain the response to the OTP. *>>* So your freeradius configuration is: *>>* 1) run MS-CHAP like normal *>* 2) do state / reply-message / challenge in "Auth-Type MS-CHAP" *>>* As a *separate* item: *>>* 3) if packet contains State *>* 4) do OTP verification *>>* The only thing tying the two packets together is the State attribute. *>* They are otherwise completely independent. *>>* Alan DeKok. *>>>>* - *>* List info/subscribe/unsubscribe? See *>* http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>*

1 1

FreeRADIUS 3 and ldap
by Victor Cenac 27 Nov '18

27 Nov '18

Bellow is my previous interaction: The info graciously provided by Alan seem to not match my version... or I need more hand holding. My installation is on ubuntu server 18.04 and I installed freeradius with apt-get. So I have version 3.0.16+dfsg-1ubuntu3. Following some other instructions I also installed freeradius-ldap. My installation is here: /etc/freeradius/3.0 so no radb folder, but that's not a big deal, as I assume on other OS the install is in /etc/radb/ In my version the ldap module is enabled according to these instructions in mods-available/README.rst: "Modules are enabled by creating a file in the mods-enabled/ directory. You can also create a soft-link from one directory to another:: $ cd raddb/mods-enabled $ ln -s ../mods-available/foo Simplification -------------- Allowing conditional modules simplifies the default virtual servers that are shipped with FreeRADIUS. This means that if you want to enable LDAP (for example), you no longer need to edit the files in raddb/sites-available/ in order to enable it. Instead, you should edit the raddb/mods-available/ldap file to point to your local LDAP server. Then, enable the module via the soft-link method described above. Once the module is enabled, it will automatically be used in the default configuration." Which I did. According to this explanation, that's all I had to do to make the FreeRADIUS use the ldap. Now, to do the matching between the ldap attributes (group membership) and the vlan communicated by the radius server to the switch... I found this in the ldap file (in mods-available): " # Mapping of LDAP directory attributes to RADIUS dictionary attributes. # # WARNING: Although this format is almost identical to the unlang # update section format, it does *NOT* mean that you can use other # unlang constructs in module configuration files. # # Configuration items are in the format: # <radius attr> <op> <ldap attr> # # Where: # <radius attr>: Is the destination RADIUS attribute # with any valid list and request qualifiers. # <op>: Is any assignment attribute (=, :=, +=, -=). # <ldap attr>: Is the attribute associated with user or # profile objects in the LDAP directory. # If the attribute name is wrapped in double # quotes it will be xlat expanded. # # Request and list qualifiers may also be placed after the 'update' # section name to set defaults destination requests/lists # for unqualified RADIUS attributes. # # Note: LDAP attribute names should be single quoted unless you want # the name value to be derived from an xlat expansion, or an # attribute ref. update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } " Is this the right place? Which lines do I repeat for multiple group-->vlan translation? For example: ldap group Staff = vlan 1 ldap group Student = vlan 2 etc. Thank you! Victor Fri, 16 Nov 2018 17:58:39 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: MAC auth with LDAP Message-ID: <0EEDAAC5-C2DA-4ABC-B0D3-93D9A0C35483(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Nov 16, 2018, at 5:13 PM, Victor Cenac <victor(a)fuller.edu> wrote: > I have a Juniper network where we assign devices to vlans based on their > MAC. The MACS are stored in an LDAP with the MAC as username and password. > The group membership is what distinguishes the vlan needed. That should be simple enough, > I managed to configure the ldap and enable the ldap module. FreeRADIUS > starts fine with it. I also added all the switches as clients. OK. > I need help figuring out: > 1. Where do I tell FreeRADIUS to look for users in ldap (vs the users file)? raddb/sites-enabled/default Look for "ldap". And, raddb/mods-available/ldap See also http://wiki.freeradius.org/. Search for "ldap". It has lots of documentations. > 2. Where do I match the group in ldap with the vlan number that needs to be > sent to the client (switch)? For example, for group Staff value is 10 (vlan > 10). You don't map LDAP names directly to VLANs. They might be "sales", and you can't use "sales" as a VLAN number. Instead, do this: if (LDAP-Group == "staff") { update reply { Tunnel Type = VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 10 } } Alan DeKok. Victor Cenac-Mehedinti Senior Systems Administrator Fuller Theological Seminary 626 396 6060

3 2

Use 2 modules to auth together.
by luckydog xf 27 Nov '18

27 Nov '18

Hi, here is my access-request from radiusd -fX Only an extra State is added comparing to the 1st auth. # Access-Challenge Ready to process requests (6) Received Access-Request Id 13 from 172.30.240.130:7460 to 172.16.237.52:1812 length 205 (6) NAS-Identifier = "Artisan_FW" (6) State = 0x654e6c7472756d474c576c6a61584b37 (6) User-Name = "someone" (6) MS-CHAP2-Response = 0x0f003132333435363638393035398846f8ca00000000000000000ac4b98d3afb9b42a0e1a1def464b78e5f6b13033d6a6e7c (6) MS-CHAP-Challenge = 0x680d6e49baa9e6f4b4f622042f0917f6 (6) NAS-IP-Address = 172.30.240.130 (6) NAS-Port-Type = Virtual (6) Called-Station-Id = "172.30.240.130" (6) Acct-Session-Id = "033ac507" (6) Connect-Info = "admin-login" (6) Fortinet-Vdom-Name = "root" (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/default As you can see there is NO User-Password attribute, which is OTP. It seems that it's caused by mschap authentication, there is no such attribute in mschap. Is there any way to input User-Password( in other words, OTP)? or my own auth method would fail to auth as there is no OTP. Thanks. On Nov 26, 2018, at 8:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Find a challenge-support Device and test it out. Let me answer it. 1. Not every NAS supports Access-Challenge, they may just ignore it and treat it as access-reject. According to my test. 2. my way of raise challeng is correct, it's built-in way of FreeRADIUS. 3. else part seesm correct, too, though I haven't hanle my own auth method, it's just a fake one. Thank Alan again. On Nov 26, 2018, at 12:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Thank, Alan, you enlighten me. Turns out NAS( my VPN) does not support Access-Challenge. Googled and found that Challenge seems to be a speical access-request packet with the Code field set to 11. So can I make the conclusion that it would send an access-quest again? in other words, start a new authentication process like another normal request with an exception that State attribute exists. Let me suppose my VPN supports Access-Challenge, so my configuation is something like: ------------------------------- authorize { # The first auth does not have any State attribute. if (!State) { # MS-CHAP has no User-Password, so it's true. if (!User-Password ) { # If !State and User-Password is null, then goes to MS-CHAP: update { &control:Auth-Type := MS-CHAP } } else { reject } # Make sure it does not contain any other attributes except State. else { update { # IS THIS PART CORRECT ? I think so, as a new request is issued by challage, so it would start over from top to buttom to walk throught the entire process. &control:Auth-Type := MY_OWN_OTP_AUTH } } } authentication { Auth-Type MS-CHAP { mschap if (ok) { update reply { # Create a random State attribute: State := "%{randstr:XXXXXXXXXXXXX}" Reply-Message := "Please type your OTP:" } # Return Access-Challenge, goes to the 2nd auth. # IS IT the correct way to raise a challange? challenge } Please help me to take a look at configuration above, two questions: 1. Is else part correct? which will use my own python auth module 2. Is it correct to raise a challenge using 'challenge' filter of FreeRADIUS? Thanks again. On Mon, Nov 26, 2018 at 8:10 PM Alan DeKok <aland atdeployingradius.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >** On Nov 26, 2018, at 2:42 AM, luckydog xf <luckydogxf at gmail.com <http://gmail.com> <http://lists.freeradius.org/mailman/listinfo/freeradius-users <http://lists.freeradius.org/mailman/listinfo/freeradius-users>>> wrote: **>* > Our user is in AD and VPN will do an MSCHAP authentication first and *>* > filter property of User-Name from access request, then call an *>* > access-challenge to verify against the other module whose logic is as *>* > simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=> <http://xxx/check/username=> *>* > <http://xxx/check/username= <http://xxx/check/username=>><USER-NAME>&OTP=<xxxxxx>, if return 200, *>* it's *>* > ok. *>>* That's really just more authorization. *>>* > Basically, I want to auth a single login against two modules, only both *>* > of them are successful, the auth could be deemed as OK. *>>* That's possible, subject to certain caveats. *>>* > # ### authentication ##### *>* > authentication { *>* > Auth-Type MS-CHAP { *>* > mschap *>* > if (ok) { *>* > update reply { *>* > # Create a random State attribute: *>* > State := "%{randstr:XXXXXXXXXXXXX}" *>* > Reply-Message := "Please type your OTP:" *>* > } *>* > # Return Access-Challenge, goes to the 2nd auth. *>* > challenge *>>* That's good, but it likely won't work due to the NAS. Doing OTP like *>* that requires support from the NAS. Does the NAS support doing MS-CHAP and *>* then receiving an Access-Challenge? *>>* If it does, then your next step is to write down what you want to *>* happen, like this: *>>* 1) packet 1 contains MS-CHAP *>* 2) it authenticates agains MS-CHAP *>* 3) if MS-CHAP is successful, it returns a State, challenge, and reply *>* message *>* 4) when the next packet comes in with a state attribute, authenticate the *>* OTP *>>* Note that the packet in step 4 *should not* contain any MS-CHAP *>* attributes. It should just contain the response to the OTP. *>>* So your freeradius configuration is: *>>* 1) run MS-CHAP like normal *>* 2) do state / reply-message / challenge in "Auth-Type MS-CHAP" *>>* As a *separate* item: *>>* 3) if packet contains State *>* 4) do OTP verification *>>* The only thing tying the two packets together is the State attribute. *>* They are otherwise completely independent. *>>* Alan DeKok. *>>>>* - *>* List info/subscribe/unsubscribe? See *>* http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>*

1 0

Use 2 modules to auth together.
by luckydog xf 27 Nov '18

27 Nov '18

Find a challenge-support Device and test it out. Let me answer it. 1. Not every NAS supports Access-Challenge, they may just ignore it and treat it as access-reject. According to my test. 2. my way of raise challeng is correct, it's built-in way of FreeRADIUS. 3. else part seesm correct, too, though I haven't hanle my own auth method, it's just a fake one. Thank Alan again. On Nov 26, 2018, at 12:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: Thank, Alan, you enlighten me. Turns out NAS( my VPN) does not support Access-Challenge. Googled and found that Challenge seems to be a speical access-request packet with the Code field set to 11. So can I make the conclusion that it would send an access-quest again? in other words, start a new authentication process like another normal request with an exception that State attribute exists. Let me suppose my VPN supports Access-Challenge, so my configuation is something like: ------------------------------- authorize { # The first auth does not have any State attribute. if (!State) { # MS-CHAP has no User-Password, so it's true. if (!User-Password ) { # If !State and User-Password is null, then goes to MS-CHAP: update { &control:Auth-Type := MS-CHAP } } else { reject } # Make sure it does not contain any other attributes except State. else { update { # IS THIS PART CORRECT ? I think so, as a new request is issued by challage, so it would start over from top to buttom to walk throught the entire process. &control:Auth-Type := MY_OWN_OTP_AUTH } } } authentication { Auth-Type MS-CHAP { mschap if (ok) { update reply { # Create a random State attribute: State := "%{randstr:XXXXXXXXXXXXX}" Reply-Message := "Please type your OTP:" } # Return Access-Challenge, goes to the 2nd auth. # IS IT the correct way to raise a challange? challenge } Please help me to take a look at configuration above, two questions: 1. Is else part correct? which will use my own python auth module 2. Is it correct to raise a challenge using 'challenge' filter of FreeRADIUS? Thanks again. On Mon, Nov 26, 2018 at 8:10 PM Alan DeKok <aland at deployingradius.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >* On Nov 26, 2018, at 2:42 AM, luckydog xf <luckydogxf at gmail.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: *>* > Our user is in AD and VPN will do an MSCHAP authentication first and *>* > filter property of User-Name from access request, then call an *>* > access-challenge to verify against the other module whose logic is as *>* > simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=> *>* > <http://xxx/check/username= <http://xxx/check/username=>><USER-NAME>&OTP=<xxxxxx>, if return 200, *>* it's *>* > ok. *>>* That's really just more authorization. *>>* > Basically, I want to auth a single login against two modules, only both *>* > of them are successful, the auth could be deemed as OK. *>>* That's possible, subject to certain caveats. *>>* > # ### authentication ##### *>* > authentication { *>* > Auth-Type MS-CHAP { *>* > mschap *>* > if (ok) { *>* > update reply { *>* > # Create a random State attribute: *>* > State := "%{randstr:XXXXXXXXXXXXX}" *>* > Reply-Message := "Please type your OTP:" *>* > } *>* > # Return Access-Challenge, goes to the 2nd auth. *>* > challenge *>>* That's good, but it likely won't work due to the NAS. Doing OTP like *>* that requires support from the NAS. Does the NAS support doing MS-CHAP and *>* then receiving an Access-Challenge? *>>* If it does, then your next step is to write down what you want to *>* happen, like this: *>>* 1) packet 1 contains MS-CHAP *>* 2) it authenticates agains MS-CHAP *>* 3) if MS-CHAP is successful, it returns a State, challenge, and reply *>* message *>* 4) when the next packet comes in with a state attribute, authenticate the *>* OTP *>>* Note that the packet in step 4 *should not* contain any MS-CHAP *>* attributes. It should just contain the response to the OTP. *>>* So your freeradius configuration is: *>>* 1) run MS-CHAP like normal *>* 2) do state / reply-message / challenge in "Auth-Type MS-CHAP" *>>* As a *separate* item: *>>* 3) if packet contains State *>* 4) do OTP verification *>>* The only thing tying the two packets together is the State attribute. *>* They are otherwise completely independent. *>>* Alan DeKok. *>>>>* - *>* List info/subscribe/unsubscribe? See *>* http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>*

1 0

Freeradius authentication with SSL client certificates
by Tom Yard 27 Nov '18

27 Nov '18

Hi people, I wanto to implement a Freeradius authentication scheme, using server and client SSL certificates: every client that require WiFI access has to have a valid SSL certificate. I think I have to use: Authetication methos: EAP-TLS Authentication protocol with NTLM: MSCHAP or MSCHAPv2 My clients are Windows, Linux and maybe Android. Is my proposal correct ? Thanking in advance. Tommy

5 4

Use 2 modules to auth together.
by luckydog xf 26 Nov '18

26 Nov '18

hi, all, Any way to handle a second access request? Our user is in AD and VPN will do an MSCHAP authentication first and filter property of User-Name from access request, then call an access-challenge to verify against the other module whose logic is as simple as starting a http request via http://XXX/check/username= <http://xxx/check/username=><USER-NAME>&OTP=<xxxxxx>, if return 200, it's ok. Basically, I want to auth a single login against two modules, only both of them are successful, the auth could be deemed as OK. # site-enabled/default authorize { if (!State) { # MS-CHAP has no User-Password, so it's true. if (!User-Password ) { # If !State and User-Password is null, then goes to MS-CHAP: update { &control:Auth-Type := MS-CHAP } } else { reject } } else { # The 2nd auth module. # I DON'T KNOW HOW TO WRITE. } } } # ### authentication ##### authentication { Auth-Type MS-CHAP { mschap if (ok) { update reply { # Create a random State attribute: State := "%{randstr:XXXXXXXXXXXXX}" Reply-Message := "Please type your OTP:" } # Return Access-Challenge, goes to the 2nd auth. challenge } } } Thanks a lot.

2 2

FreeRadius 3.0.17 - outer tunnel username in accounting logs instead of inner tunnel username
by Thorsten Fritsch 23 Nov '18

23 Nov '18

Hi guys, we have recently upgraded our FreeRadius to release 3.0.17 and are now facing the issue that the accounting logs seem to contain the username provided in the anonymous (outer) identity field instead of the username used for the inner tunnel. This makes it hard to identify our eduroam users (user tracking). Has something changed in FreeRadius 3.x regarding thise behavior ? In my understanding the Radius server should provide the inner tunnel username to the NAS (in our case Cisco WLAN Controller) by parameter use_tunneled_reply = yes in the eap file under /mods-enabled which the NAS can then in turn provide to the Accounting server is that correct ? We have set this setting to yes in our config: ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } Thanks for your help. Cheers, Thorsten

3 4

No connections available and at max connection limit
by تعلم البرمجة 22 Nov '18

22 Nov '18

Hello all i have this problem and i want solve it rlm_sql (sql): No connections available and at max connection limit

2 1

Re: TXID mismatch between DHCP Request-Offer (devel version)
by Chinnapaiyan, Nagamani 22 Nov '18

22 Nov '18

It works after changing the code in my local repo... Thanks... We are storing TXID as it is(without ntohl). But while sending we are doing htonl. Corrected that also. # git diff diff --git a/src/modules/proto_dhcpv4/proto_dhcpv4.c b/src/modules/proto_dhcpv4/proto_dhcpv4.c index 465a3ea..3a80a8f 100644 --- a/src/modules/proto_dhcpv4/proto_dhcpv4.c +++ b/src/modules/proto_dhcpv4/proto_dhcpv4.c @@ -416,7 +416,7 @@ static ssize_t mod_encode(void const *instance, REQUEST *request, uint8_t *buffe } data_len = fr_dhcpv4_encode(buffer, buffer_len, - request->reply->code, original->xid, request->reply->vps); + request->reply->code, ntohl(original->xid), request->reply->vps); if (data_len < 0) { RPEDEBUG("Failed encoding DHCPV4 reply"); return -1; diff --git a/src/protocols/dhcpv4/packet.c b/src/protocols/dhcpv4/packet.c index 5460041..38790f9 100644 --- a/src/protocols/dhcpv4/packet.c +++ b/src/protocols/dhcpv4/packet.c @@ -218,6 +218,12 @@ int fr_dhcpv4_packet_decode(RADIUS_PACKET *packet) } p += len; } +//Decode message type from the option. +VALUE_PAIR *message_type = NULL; +message_type = fr_pair_find_by_da(head, attr_dhcp_message_type, TAG_ANY); +if(message_type) { +packet->code = message_type->vp_uint8; +} /* * If option Overload is present in the 'options' field, then fields 'file' and/or 'sname' Regards, Nagamani Chinnapaiyan

2 1